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DETAILED ACTION 

Continued Examination Under 37 CFR 1.114 

A request for continued examination under 37 CFR 1.1 14, including the fee set forth in 
37 CFR 1 .17(e), was filed in this application after final rejection. Since this application is 
eligible for continued examination under 37 CFR 1.1 14, and the fee set forth in 37 CFR 1.17(e) 
has been timely paid, the finality of the previous Office action has been withdrawn pursuant to 
37 CFR 1.1 14. Applicant's submission filed on 1 1/7/2007 has been entered. 



Response to Amendment 

Applicant's arguments/amendments with respect to amended claims 1 & 12, previously 
presented claims 2-1 1 & 13-26 filed 1 1/7/2007 have been fully considered, but they are not 
persuasive. 

Response to Arguments 

Applicants contend that Bates fails to teach or suggest "a scan log which is sent back to at 
least one of the first anti-virus scanning server and the second anti-virus scanning server over 
said distributed computer network from each client user detailing specific results of the scanning 
on each client end-user computer by said antivirus scanning program." Applicants further 
contend that Bates fails to teach or suggest "generating a scan log from each scanned client end- 
user computer and sending the scan log back from each client over said distributed computer 
network, the scan log detailing specific results of the scanning program on each client end-user 
computer." Examiner respectfully disagrees. Bates teaches downloading (to the client 
computer) a client copy of a virus checker program (from one of the various vendors chosen). 
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where the downloading step is followed by executing that antivirus program on the client's 
computer (col. 11, lines 17-25). Once the scanning process has completed, a log of information 
detailing any viruses that may have been found, or a message conveying that no virus has been 
found, i.e. specific results, is sent back to the server where the details are stored (col. 11, lines 
25-38). Thus, Bates teaches a scan log which is sent back to at least one of the first anti-virus 
scanning server and the second anti-virus scanning server over said distributed computer network 
from each client user detailing specific results of the scanning on each client end-user computer 
by said antivirus scanning program and generating a scan log from each scanned client end-user 
computer and sending the scan log back from each client over said distributed computer network, 
the scan log detailing specific results of the scanning program on each client end-user computer. 

Due to the reasons stated above, the Examiner maintains rejections with respect to the 
pending claims. The prior arts of records taken singly and/or in combination teach the limitations 
that the Applicant suggests distinguish from the prior art. Therefore, it is the Examiner's 
conclusion that the pending claims are not patentably distinct or non-obvious over the prior art of 
record as presented. 

Claim Rejections - 35 USC §103 

I. The following is a quotation of 35 U.S. C. 103(a) which forms the basis for all 
obviousness rejections set forth in this Office action: 

(a) A patent may not be obtained though the invention is not identically disclosed or described as set forth in 
section 102 of this title, if the differences between the subject matter sought to be patented and the prior art are 
such that the subject matter as a whole would have been obvious at the time the invention was made to a person 
having ordinary skill in the art to which said subject matter pertains. Patentability shall not be negatived by the 
manner in which the invention was made. 
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II. Claims 1-7, 9, 11-18, 20, and 22-26 are rejected under 35 U.S.C. 103(a) as being 
unpatentable over Bates et al. United States Patent No. 6,785,732 and further in view of Hill et 
al. United States Patent No. 6,088,804. 
As per claims 1 and 12: 

Bates et al. substantially teach a system/method comprising: a plurality of client users 
having potentially infected client end-user computers, said end-user computers being distributed 
over said distributed computer network (col. 3, lines 41-50); a first anti-virus scanning server 
executing from a first vendor and a second antivirus scanning server executing software from a 
second vendor, each accessible via the distributed computer network, said first anti-virus 
scanning server and said second anti-virus scanning server each including an anti-virus scanning 
program, whereby the client users contact the first scanning server or the second scanning server 
to facilitate virus scanning of the client end-user computers by downloading said anti-virus 
scanning program (col. 8, line 45 - col. 9, line 1 1 and Fig. 6); a scan log which is sent back to at 
least one of the first anti-virus scanning server and the second anti-virus scanning server over 
said distributed computer network from each client user detailing specific results of the virus 
scanning on each client end-user computer by said antivirus scanning program (col. 8, lines 11- 
15); a virus-tracking server for receiving the scan log information from said client end-user 
computers via the first anti-virus scanning server from the first vendor and the second anti-virus 
scanning server from the second vendor (col. 6, lines 4-20 and col. 9, lines 47-60); a database 
server associated with the virus-checking server for processing the scan log information into 
virus-tracking information (col. 6, lines 4-20 and col. 9, lines 47-60); and a tracking user from 
the virus tracking server (col. 11, lines 39-67). 
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Not explicitly disclosed is wherein the scan log information is received by the virus- 
tracking server in real time and at least one virus-tracking display mode accessible by a tracking 
user, the display mode providing real-time updates of said virus-tracking information pertaining 
to the scan logs, wherein the anti-virus scanning program residing at the client end-user 
computers generates one or more maps displaying the real-time updates, and wherein the one or 
more maps are generated and displayed at the client end-user computers. However, Hill et al. 
teach displaying in real-time, to an administrator of some type, graphs of virus detection 
incidents in various geographical sub-regions in order to keep track of potential viruses that may 
spread and damage other systems if no action is taken (col. 3, lines 36-41). Hill et al. further 
teach that each of the agents who provide the information recorded and displayed in the graph 
may also view the graph so that they are aware of how quickly and in what sub-regions a 
virus/attack is spreading (col. 8, line 59 - col. 9, line 25). Therefore, it would have been obvious 
to a person in the art at the time the invention was made to modify the system disclosed in Bates 
et al. to have a displaying mechanism that is updated in real-time in order to ensure early 
detection of possible viral threats. This modification would have been obvious because a person 
having ordinary skill in the art, at the time the invention was made, would have been motivated 
to do so since Hill et al. suggest that displaying the possible threats in a manner that allows quick 
interpretation of the situation is imperative in minimizing the impact that the virus may have on 
the network as a whole in col. 7, lines 3-17 and col. 9, lines 17-19. 
As per claims 2 and 13: 

Bates et al. and Hill et al. substantially teach the system/method of claims 1 and 12. 
Furthermore, Hill et al. teach wherein the tracking user can configure the display modes to show 



Application/Control Number: 09/702,289 Page 6 

Art Unit: 2137 

the virus-tracking information in association with user-selected geographic maps of where the 
viruses are occurring (col. 3, lines 36-41). 
As per claims 3 and 14: 

Bates et al. and Hill et al. substantially teach the system/method of claims 1 and 12. 
Furthermore, Hill et al. teach wherein display modes include a plurality of web pages with user 
selectable menus to configure the virus-tracking display on the pages (col. 9, lines 20-25). 
As per claims 4 and 15: 

Bates et al. and Hill et al. substantially teach the system/method of claims 1 and 12. 
Furthermore, Bates et al. teach a scan log contains no information relating to the direct 
identification of the client user (col. 12, lines 41-45). 
As per claims 5 and 16: 

Bates et al. and Hill et al. substantially teach the system/method of claims 1 and 12. 
Furthermore, Hill et al. teach that the scan log includes the name of the virus, the frequency of its 
occurrence, and the geographic location of the infected computer (col. 8, lines 23-35). 
As per claims 6 and 17: 

Bates et al. and Hill et al. substantially teach the system/method of claims 1 and 12. 
Furthermore, Bates et al. teach a servlet program on the virus-tracking server is used to receive 
the scan log information from the at least one anti-virus scanning server (col. 8, line 45 - col. 9, 
line 1 1). 

As per claims 7 and 18: 

Bates et al. and Hill et al. substantially teach the system/method of claims 1 and 12. 
Furthermore, Bates et al. teach a polling program is used to regularly retrieve virus-tracking 
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information from the database server and store it in a data object (col. 12, lines 37-58). 
As per claims 9 and 20: 

Bates et al. and Hill et al. substantially teach the system/method of claims 1 and 12. 
Furthermore, Hill et al. teach a Java applet running on tracking user browser is used to display a 
real-time virus-tracing map (col. 6, lines 45-67). 
As per claims 1 1 and 22: 

Bates et al. and Hill et al. substantially teach the system/method of claims 1 and 12. 
Furthermore, Bates et al. teach the system wherein the distributed computer network includes the 
Internet, wherein said scan log from each scanned client computer is sent back over the Internet 
to be received by said virus tracking server (col. 8, line 45 - col. 9, line 1 1). Yet further. Hill et 
al. teach wherein said virus tracking display mode is accessible over the Internet by said tracking 
user (col. 8, lines 7-16). 
As per claims 23 and 25 : 

Bates et al. and Hill et al. substantially teach the system/method of claims 1 and 12. 
Furthermore, Hill et al. teach wherein said virus-tracking information identifies concentrations of 
a computer virus at said client end-user computer locations (col. 8, lines 23-35). 
As per claims 24 and 26: 

Bates et al. and Hill et al. substantially teach the system/method of claims 1 and 12. 
Furthermore, Bates et al. teach wherein said scan log information is processed by aggregating 
said scan logs from each client end-user computer and then synthesizing said virus tracking 
information (col. 6, lines 6-20) 
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III. Claims 8, 10, 19, and 21 are rejected under 35 U.S.C. 103(a) as being unpatentable over 
Bates et al. United States Patent No. 6,785,732 and Hill et al. United States Patent No. 
6,088,804 as applied to claims 1, 7, 12, and 18 above, and further in view of Trcka et al. United 
States Patent No. 6,453,345 
As per claims 8 and 19: 

Bates et al. and Hill et al. substantially teach the system/method of claims 7 and 18. Not 
explicitly disclosed is a common gateway interface program used to retrieve the data object for 
display by the tracking user. Trcka et al. teach traffic capture components, which run 
continuously in the background, to passively generate a data stream that represents the traffic 
present on the network (col. 10, lines 60-66). It would have been obvious to a person having 
ordinary skill in the art at the time of the invention was made to modify Bates et al.'s 
collaborative server by reporting and logging information about viruses tracking for the client 
user in order that the client may utilize the information to deploy anti-virus programs. 
As per claims 10 and 21 : 

Bates et al. and Hill et al. substantially teach the system/method of claims 1 and 12. Not 
explicitly disclosed is wherein the client user is also the tracking user. Trcka et al. teach from the 
screens, the user can specify such parameters as start time/date, end time/date, the types of events 
of interest. The user can specify search criteria and specific fields to be searched and can specify 
an output type of the display screen, the printer, or the file (col. 20, lines 5-12). It would have 
been obvious to a person having ordinary skill in the art at the time of the invention was made to 
modify Bates et al.'s collaborative server by allowing the client user to also be the user, thus 
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allowing individuals to set-up web sights and protect their computer from viruses by use of the 
allowed operations. 

"^References Cited, Not Used 

The prior art, US Patent No. 6,721,721, made of record and not relied upon is considered 
pertinent to applicant's disclosure. US Patent No. 6,721,721 has been cited because it is relevant 
to the displaying/virus tracking portions of the claimed invention. 

Conclusion 

Any inquiry concerning this communication or earlier communications from the 
examiner should be directed to Nadia Khoshnoodi whose telephone number is (571) 272-3825. 
The examiner can normally be reached on M-F: 8:00-4:30. 

If attempts to reach the examiner by telephone are unsuccessful, the examiner's 
supervisor, Emmanuel Moise can be reached on (571) 272-3865. The fax phone number for the 
organization where this application or proceeding is assigned is 571-273-8300. 
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Information regarding the status of an application may be obtained from the Patent 
Application Information Retrieval (PAIR) system. Status information for published applications 
may be obtained from either Private PAIR or Public PAIR. Status information for unpublished 
applications is available through Private PAIR only. For more information about the PAIR 
system, see http://pair-direct.uspto.gov. Should you have questions on access to the Private PAIR 
system, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would 
like assistance from a USPTO Customer Service Representative or access to the automated 
information system, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000. 

/Nadia Khoshnoodi/ 
Examiner, Art Unit 2137 
4/8/2008 

NK 

/Emmanuel L. Moise/ 

Supervisory Patent Examiner, Art Unit 2137 



